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REMARKS 

The Examiner has rejected Claims 1,17, 33, 34, 39 and 44 and the intervening 
claims under 35 U.S.C. 1 12, first paragraph, as failing to comply with the written 
description requirement. Applicant has, in part, clarified such claims to avoid such 
rejection. Specifically, applicant has deleted "traversing the hierarchical parse tree to 
retrieve each suspect string and" from each of the independent claims. 

Furthermore, with respect to the Examiner's rejection of applicant's claimed "data 
file defining macro virus attributes for known macro viruses that each are comprised of at 
least one macro," applicant respectfully asserts that the "comprised of a macro" language 
is inherently disclosed. Specifically, when read in the context of the following well- 
known definition of a macro virus, il is clear that such claim language is inherently 
disclosed: 

tt A type of computer virus that is encoded as a macro embedded in 
a document. Many applications, such as Microsoft Word and Excel, 
support powerful macro languages. These applications allow you to 
embed a macro in a document, and have the macro execute each time 
the document is opened." 

( http : //www, webopedia . cont/TERM/rr./macxo virus . html ) 

The Examiner has rejected Claims 1-44 under 35 U.S.C. 103(a) as being 
unpatentable over Chen et al. (U.S. Patent No. 5,951,698) in view of Chen et al. (U.S. 
Patent No. 5,960,170) hereinafter referred to as Chen. Applicant respectfully disagrees 
with such rejection, especially in view of the amendments made hereinabove to each of 
the independent claims. Specifically, applicant has incorporated the subject matter of 
dependent Claims 14 and 16 et al. into each of the independent claims. 

With respect to each of the independent claims, the Examiner has relied on Chen 
et al.'s disclosure of "a data table including exemplary sets of instruction identifiers 
which are stored in the virus information module 308" and "the decoded macro is 
scanned to determine whether it includes a combination of suspect instructions as 
identified by the instruction identifiers" (Col. 14, line 52-CoI. 15, line 67) to meet 
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applicant's claimed "sets of the indices and the macro virus definition data files being 
organized into a hierarchy according to macro virus families based on a type of 
application to which the macro applies" (see this or similar, but not identical, language in 
each of the foregoing claims). 

Applicant respectfully asserts that Chen et al. fails to meet applicant's claim 
language since it clearly fails to teach the "hierarchy [is organized] according to macro 
virus families based on a type of application to which the macro applies." The data table 
of Chen et al., as depicted in Figure 9 and referenced by the Examiner, is not based on a 
type of application which the macro applies, but instead is based on instruction 
identifiers. Specifically, Chen et al. merely shows that the rows correspond to instruction 
identifiers and the columns correspond to instruction identifier numbers, text and 
corresponding hexadecimal representations of the binary code for the instruction 
identifiers (see also Col. 15, lines 1-6), and not "a hierarchy., . based on a type of 
application to which the macro applies " (emphasis added), as claimed by applicant. 

Furthermore, the Examiner has also relied on Chen to make a prior art showing of 
applicant's above mentioned claim language, specifically "the sets of the indices and the 
macro virus definition data files being organized into a hierarchy according to macro 
virus families based on a type of application to which the macro applies." Applicant 
respectfully asserts that the excerpts from Chen relied on by the Examiner simply 
disclose "a program for accessing the file header for each file. . .comparing the file header 
to predetermined data to determine whether the file is of a type that is likely to contain a 
virus, and maintaining an identification of those files" (Col. 18, lines 16-27) and '*[o]ne 
way that the amount of data to be transmitted from the virus detection server 400 to the 
client 300 is minimized is that only those virus signatures that could be expected 
according to the gathered information about the assessed scope and risk from previous 
stages" (Col. 19, lines 15-30). 

Applicant respectfully asserts that determining types of files that are likely to 
contain a virus for future scanning such that the amount of data to be transmitted from the 
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virus detection server to the client is minimized simply does not meet applicant's claimed 
"sets of the indices and the macro virus definition data files being organized into a 
hierarchy according to macro virus families based on a type of application to which the 
macro applies." Specifically, Chen clearly fails to mention utilizing any hierarchy system 
for organizing " sets of indices and the macro virus definition data files /' let alone where 
the hierarchy is organized "according to macro virus families based on a type of 
application to which the macro applies " (emphasis added). 

In addition, the Examiner has relied on Chen's disclosure of "iteratively scanning 
all targeted files for the relevant string portions to progressively narrow the number of 
viruses that could reside in the targeted files" (Col. 13, line 44-Col. 14 line 31) to make a 
prior art showing of applicant's claimed "parser parsing a suspect file into tokens 
comprising one of individual string constants and source code text and storing the tokens 
as suspect strings into a hierarchical parse tree" (see this or similar, but not identical, 
language in each of the foregoing claims). 

Applicant respectfully asserts that Chen simply teaches scanning targeted files to 
determine whether they include relevant string portions. The only parsing associated 
with Chen involves parsed virus signatures (portions) that are compared to an entire file. 
In addition, scanning an entire file in such a manner as to progressively reduce the 
number of viruses a file is scanned for teaches away from applicant's claimed "parsing a 
suspect file into tokens comprising one of individual string constants and source code 
text" since a file could not be scanned as a whole unit if it was parsed, as claimed by 
applicant. 

Furthermore, Chen does not teach "storing the tokens as suspect" strings into a 
hierarchical parse tree," as claimed by applicant, since Chen teaches continuously 
scanning the entire file for progressively reduced virus signatures, and not that any 
portions of the file are ever stored in the manner claimed. Chen only discloses "using 
this result [whether a specific string portion of a virus definition has been found in the 
file] to produce a second virus detection object" (Col. 14, lines 6-8). Thus, only the 
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reduced possible viruses in the file are stored in a new object and not "suspect strings" in 
the context claimed by applicant. In the same manner, Chen also does not teach storing 
the suspect strings " into a hierarchical parse tree " (emphasis added). 

To establish a prima facie case of obviousness, three basic criteria must be met. 
First, there must be some suggestion or motivation, either in the references themselves or 
in the knowledge generally available to one of ordinary skill in the art, to modify the 
reference or to combine reference teachings. Second, there must be a reasonable 
expectation of success. Finally, the prior art reference (or references when combined) 
must teach or suggest all the claim limitations. The teaching or suggestion to make the 
claimed combination and the reasonable expectation of success must both be found in the 
prior art and not based on applicant's disclosure. In re Vaeck t 941 F.2d 488, 20 USPQ2d 
1438 (Fed.Cir.1991). 

Applicant respectfully asserts that at least the third element of the prima facie 
case of obviousness has not been met, since the prior art references, when combined, fail 
to teach or suggest all of the claim limitations, as noted above. Nevertheless, despite 
such paramount deficiencies and in the spirit of expediting the prosecution of the present 
application, applicant has substantially incorporated the subject matter of Claims 14 and 
16 et al. into each of the independent claims. 

With respect to Claims 14 and 16 et al., the Examiner has relied on Chen et al.'s 
disclosed "macro locating and decoding module 302 includes routines which initially 
determine whether the targeted file include a macro by determining in step 505 what type 
of file it is" (Col. 12, lines 8-11), a "macro virus scanning module 304 [that] accesses 
decoded macros in the data buffer 312 and determines whether they include known virus 
signatures" (Col. 13, lines 10-12), and "macro instructions from the targeted file [that] are 
located and decoded into binary code for analysis. . .[t]hus, the comparison data which is 
obtained 615 from the virus information module 308 may respectively include the binary 
code for the first and second instructions.. .to identify the first and second instruction in 
the macro from a targeted file" (Col. 14, lines 25-36). 
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Applicant respectfully asserts that Chen et al. completely fails to even suggest 
applicant's claimed "macro virus checker parsing macro virus attributes from one or 
more file objects and analyzing the macro virus definition data files by index for each 
macro virus family" (Claim 14 et al. - emphasis added) and ''macro virus checker 
iteratively retrieving each macro virus definition data file using the index for each macro 
virus family and providing the macro virus attributes defined in the retrieved macro virus 
definition data file" (Claim 16 et al. - emphasis added). 

Chen merely teaches ll [a] unique binary code [that] also corresponds to suspect 
instructions" such that a specific macro virus enablement instruction has a particular 
corresponding binary code, as does a certain macro virus reproduction instruction (see 
Col. 14, lines 28-31), such that particular binary strings are used as an identifier for 
detecting a plurality of different suspect macro instructions (Col. 14, lines 47-50). 
Simply nowhere in Chen et al. is there any teaching of utilizing an index in the context 
claimed by applicant, since Chen does not teach that such particular binary strings are 
indexed in any manner such that the index is utilized in scanning for macro viruses. 

Since at least the third element of the prima facie case of obviousness has not 
been met, a notice of allowance or a specific prior art showing of all of the claim 
limitations, in the context of the remaining elements, is respectfully requested. 

Thus, all of the independent claims are deemed allowable. Moreover, the 
remaining dependent claims are further deemed allowable, in view of their dependence 
on such independent claims. 

In the event a telephone conversation would expedite the prosecution of this 
application, the Examiner may reach the undersigned at (408) 505-5100. The 
Commissioner is authorized to charge any additional fees or credit any overpayment to 
Deposit Account No. 50-1351 (Order No. NAI1P373/99.1 11.01). 
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P.O. Box 721120 

San Jose, CA 95172-1 120 

408-505-5100 



RespectfuDy submitted, 
Zilka-Kqlfeb»PC. 
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